On 30 September 2026, the Information Commissioner's Office will formally become the Information Commission. It is the most significant structural change to the UK's data protection regulator in its history, and yet, many organisations are wondering what practical implications this change will have. Here's what you need to know.
From Commissioner to Commission
The transformation is mandated by the Data (Use and Access) Act 2025 (DUAA), which received Royal Assent on 19 June 2025. Among its many reforms to UK data protection law, DUAA abolishes the office of the Information Commissioner (a single officeholder model) and replaces it with the Information Commission, a corporate body governed by a Board. Seven Non-Executive Members were appointed to the new Information Commission Board in July 2026 and will assume their roles when the transition takes effect. (For more information see the Information Commission section of our article here).
Importantly, the regulator has confirmed it will continue to be known as "the ICO", now standing for the Information Commission's Office rather than the Information Commissioner's Office. All existing statutory references to the Information Commissioner in UK law will be read as references to the Information Commission, and a transfer scheme will move property, rights and liabilities from the old office to the new body.
Why does the governance change matter?
Although this may appear to be a structural rebrand, it is rather more than that. As we wrote in our earlier article, the shift "represents a significant move to a new governance model designed to provide clearer accountability, improved oversight and more consistent regulatory decision making". Moving from a single Commissioner to a Board-led structure is intended to bring the regulator into line with other major UK regulators such as the FCA and Ofcom, strengthening institutional resilience and distributing decision-making authority more broadly.
The ICO itself has framed the changes as enabling it to "continue to operate as a trusted, fair and independent regulator with a stronger and modernised structure". For organisations subject to UK data protection law, this signals a regulator that is likely to be more structured and consistent in its approach – and some think potentially more assertive.
New powers to watch
The governance changes do not exist in isolation. DUAA also grants the regulator significant new investigatory and enforcement powers. These include the ability to compel witnesses to attend interviews and to request reports from approved persons. Enforcement powers under the Privacy and Electronic Communications Regulations (PECR) have also been aligned with those under the UK GDPR, meaning the regulator now has a more consistent and robust enforcement toolkit across its full remit. (For more information see the Information Commission's new powers section of our article here).
These wide-ranging ICO powers bring the regulator into line with other UK regulators and will change how the ICO currently conducts its investigations. The ICO published draft enforcement procedural guidance setting out the process it intends to follow when carrying out investigations and taking enforcement action, confirming that while it aims to give organisations certainty first, it "can, and will, use these powers where necessary for the most serious cases". At the time of writing, the final guidance is awaited.
What organisations should do now
The transition does not impose new compliance obligations on data controllers or processors in and of itself, however, there are several practical steps worth considering:
- Update internal references. Where organisational policies, privacy notices, or data processing agreements refer to the "Information Commissioner" or "Information Commissioner's Office," consider updating these to reflect the new terminology in due course. For those using the abbreviation ICO you need only amend the original definition as, as noted above, the regulator will still be known by the abbreviation "ICO". The statutory reading-across provision means existing references will remain legally valid but keeping documentation current demonstrates good governance.
- Track regulatory priorities closely. With a new Board comes the potential for a shift in regulatory focus and tone. It will be important to keep a close watch on how the ICO sets its early priorities and how its new powers and structure translate into day-to-day supervision and enforcement.
- Familiarise yourself with the new enforcement toolkit. The enhanced powers to compel witness attendance and request approved person reports represent a material change to how investigations may be conducted. Organisations should review their incident response plans and ensure their teams understand what co-operation with the regulator may now look like.
- Stay on top of updated guidance. The ICO has been revising its guidance throughout 2025 and 2026 to reflect the DUAA reforms and will continue to do so. Monitoring these updates is essential – see here for more information.
The bottom line
The rebrand from the ICO to the Information Commission is not merely cosmetic. It signals a more mature, Board-led regulatory model with enhanced powers and, potentially, a more structured approach to enforcement. Organisations would be wise to treat this as a moment to refresh their understanding of the regulatory landscape and ensure they are ready for a regulator that is, in every sense, better equipped to hold them to account.
